Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63446: Suricata 8.0.0‑8.0.5 may run out of CPU or memory

CVE-2026-63446 · published 1 month ago

Summary

Versions 8.0.0 through 8.0.5 of Suricata can keep unfinished network traffic records forever when a pass rule is used. Over time these records build up, using more processing power and memory until the system slows down or stops. Upgrade to Suricata 8.0.6 or later to stop the buildup.

What to do

Update debian suricata to version 1:8.0.6-1.
Update oisf suricata to version 8.0.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	oisf	suricata	>= 8.0.0, < 8.0.6
Debian:13	debian	suricata	All versions
Debian:14	debian	suricata	< 1:8.0.6-1 Fix: upgrade to 1:8.0.6-1
Ubuntu:16.04:LTS	canonical	suricata	All versions

Original advisory text

Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.

References

https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 URL
https://redmine.openinfosecfoundation.org/issues/8628 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63446... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63446 Vendor Advisory
https://ubuntu.com/security/CVE-2026-63446 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-63446 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-63446 Vendor Advisory
https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m Vendor Advisory
https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8 Patch
https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7 Patch
https://github.com/OISF/suricata/pull/15726 Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-401Memory Leak

CWE-407Inefficient Algorithmic Complexity

Timeline

Published18 Sep 2026

Updated4 Nov 2026

First seen18 Sep 2026

Sources

CVE-2026-63446 · NVD

CVE-2026-63446 · MITRE

DEBIAN-CVE-2026-63446 · OSV

CVE-2026-63446 · OSV

GHSA-gjwr-75gq-877m · GHSA

UBUNTU-CVE-2026-63446 · OSV

Track software like this

Free during beta